1c-metadata-manage
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses PowerShell scripts to automate 1C:Enterprise Platform operations by invoking the
1cv8.exeexecutable with specific command-line arguments. These operations include building and dumping external data processors (EPF/ERF), loading metadata configurations, and updating database schemas, which are standard tasks for 1C development. - [PROMPT_INJECTION]: The skill provides 'info' scripts (e.g.,
meta-info.ps1,form-info.ps1,skd-info.ps1) that read local configuration source files and generate summaries for the agent. This represents an indirect prompt injection surface as the scripts do not employ specific boundary markers or 'ignore embedded instructions' warnings when outputting data extracted from potentially untrusted project files. - [COMMAND_EXECUTION]: Various scripts, including
meta-compile.ps1androle-compile.ps1, automatically manage the configuration's root file (Configuration.xml) by inserting new object registrations into the<ChildObjects>section based on user-defined JSON inputs. - [COMMAND_EXECUTION]: The
db-run.ps1script allows for the automated launching of 1C:Enterprise in background mode, supporting optional parameters for auto-executing external processors or navigating to specific internal URLs.
Audit Metadata